Unrated severityNVD Advisory· Published Oct 7, 2026

CVE-2026-97331

Description

The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning that user's email address, allowing any authenticated user, such as a Subscriber, to obtain the email address of any registered account, including administrators.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/User Private Filesllm-fuzzy
Range: <2.1.9
Package: https://wordpress.org/plugins/user-private-files

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/e61799b5-1ea7-407b-9303-4b828bb5e5f5/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000